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Section I 
INTRODUCTORY 

Paragraph 



Preliminary remarks 1 

General remarks upon the nature of cryptographic periodicity 2 

Effects of varying the length of the plain-text groupings 3 

Primary and secondary periods; resultant periods 4 



1. Preliminary remarks. — a. The text immediately preceding this devoted itself almost 
exclusively to polyalphabetic substitution systems of the type called repeating-key ciphers. 
It was seen how a regularity in the employment of a limited number of alphabets results in the 
manifestation of periodicity or cyclic phenomena in the cryptogram, by means of which the 
latter may be solved. The difficulty in solution is directly correlated with the type and number 
of cipher alphabets employed in specific examples. 

b. Two procedures suggest themselves for consideration when the student cryptanalyst 
realizes the foregoing circumstances and thinks of methods to eliminate the weaknesses inherent 
in this cryptographic system. First, noting that the difficulties in solution increase as the 
length of the key increases, he may study the effects of employing much longer keys to see if 
one would be warranted in placing much trust in that method of increasing the security of the 
messages. Upon second thought, however, remembering that as a general rule the first step 
in the solution consists in ascertaining the number of alphabets employed, it seems to him that 
the most logical thing to do would be to use a procedure which will avoid periodicity altogether, 
will thus eliminate the cyclic phenomena that are normally manifested in cryptograms of a 
periodic construction, and thus prevent an enemy cryptanalyst from taking even a first step 
toward solution. In other words, he will investigate the possibilities of aperiodic systems first 
and if the results are unsatisfactory, he will then see what he can do with systems using lengthy 
keys. 

c. Accordingly, the first part of this text will be devoted to an examination of certain of the 
very simplo varieties of aperiodic, polyalphabetic substitution systems; after this, methods of 
extending or lengthening short mnemonic keys, and systems using lengthy keys will be studied. 

2. General remarks upon the nature of cryptographic periodicity. — a. When the thoughtful 
student considers the matter of periodicity in polyalphabetic substitution systems and tries to 
ascertain its real nature, he notes, with some degree of interest and surprise perhaps that it is 
composed of two fundamental factors, because there are in reality two elements involved in its 
production. He has, of course, become quite familiar with the idea that periodicity necessitates 
the use of a keying element and that the latter must be employed in a cyclic manner. But he 
now begins to realize that there is another element involved, the significance of which he has 
perhaps not fully appreciated, viz, that unless the key is applied to constant-length plain-text 
groups no periodicity will be manifested externally by the cryptogram, despite the repetitive or 
cyclic use of a constant-length key. This realization is quickly followed by the idea that possibly 
all periodicity may be avoided or suppressed by either or both of two ways; (1) By using constant- 
length keying units to encipher variable-length plain- text groupings or (2) by using variable- 
length keying units to encipher constant-length plain- text groupings. 

b. The student at once realizes also that the periodicity exhibited by repeating-key ciphers 
of the type studied in the preceding text is of a very simple character. There, successive letters 
of the repetitive key were applied to successive letters of the text. In respect to the employment 
of the key, the cryptographic or keying process may be said to be constant ox fixed in character. 
This terminology remains true even if a single keying unit serves to encipher two or more letters 

U) 



2 



at a time, provided only tliat the groupings of plain- text letters are constant in length. For 
example, a single key letter may serve to encipher two successive plain-text letters ; if the key is 
repetitive in character and the message is sufficient in length, periodicity will still be manifested 
by the cryptogram and the latter can be solved by the methods indicated in the preceding text. 1 
Naturally, those methods would have to be modified in accordance with the specific type of 
grouping involved. In this case the factoring process would disclose an apparent key length 
twice that of the real length. But study of the frequency distributions would soon show that 
the 1st and 2d distributions were similar, the 3d and 4th, the 5th and 6th, and so on, depending 
upon the length of the key. The logical step is therefore to combine the distributions in proper 
pairs and proceed as usual. 

c. In all such cases of encipherment by constant-length groupings, the apparent length of 
the period (as found by applying the factoring process to the cryptogram) is a multiple of the 
real length and the multiple corresponds to the length of the groupings, that is, the number of 
plain-text letters enciphered by the same key letter. 

d. The point to be noted, however, is that all these cases are still periodic in character, 
because both the keying units and the plain-text groupings are constant in length. 

8. Effects of varying the length of the plain-text groupings. — a. But now consider the effects 
of making one or the other of these two elements variable in length. Suppose that the plain-text 
groupings are made variable in length and that the keying units are kept constant in length. 
Then, even though the key may be cyclic in character and may repeat itself many times in the 
course of encipherment, external periodicity is suppressed, unless the law governing the variation 
in plain-text groupings is itself cyclic in character, and the length of the message is at least two or 
more times that of the cycle applicable to this variable grouping. 

b. (1) For example, suppose the correspondents agree to use reversed standard cipher 
alphabets with the key word SIGNAL, to encipher a message, the latter being divided up into 
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as shown below: 
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1 In this connection, see Section III, Military Cryptanalysis, Part If 
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(2) The cipher text in this example (Fig. 1) shows a tetragraphic and a pentagraphic 
repetition. The two occurrences of QUWUG (= COMMA) are separated by an interval of 90 
letters; the two occurrences of ARQN ( =IRST) by 39 letters. The former repetition (QUWUG) , 
it will be noted, is a true periodic repetition, since the plain-text letters, their grouping, and 
the key letters are identical. The interval in this case, if counted in terms of letters, is the 
product of the keying cycle, 6, by the grouping cycle, 15. The latter repetition (ARQN) is not 
a true periodic repetition in the sense that both cycles have been completed at the same point, 
as is the case in the former repetition. It is true that the cipher letters ARQN, representing 
IRST both times, are produced by the same key letters, I and G, but the enciphering points in 
the grouping cycle are different in the two cases. Repetitions of this type may be termed 
partially periodic repetitions, to distinguish them from those of the completely periodic type. 

c. When the intervals between the two repetitions noted above are more carefully studied, 
especially from the point of view of the interacting cycles which brought them about, it will be 
seen that counting according to groupings and not according to single letters, the two pentagraphs 
QUWUG are separated by an interval of 30 groupings. Or, if one prefers to look at the matter in 
the light of the keying cycle, the two occurrences of QUWUG are separated by 30 key letters. 
Since the key is but 6 letters in length, this means that the key has gone through 5 cycles. Thus, 
the number 30 is the product of the number of letters in the keying cycle (6) by the number 
of different-length groupings in the grouping cycle (5). The interaction of these two cycles 
may be conceived of as partaking of the nature of two gears which are in mesh, one driven by 
the other. One of these gears has 6 teeth, the other 5, and the teeth are numbered. If the 
two gears are adjusted so that the “number 1 teeth” are adjacent to each other, and the gears 
are caused to revolve, these two teeth will not come together again until the larger gear has 
made 5 revolutions and the smaller one 6. During this time, a total of 30 meshings of individual 
teeth will have occurred. But since one revolution of the smaller gear (=the grouping cycle) 
represents the encipherment of 15 letters, when translated in terms of letters, the 6 complete 
revolutions of this gear mean the encipherment of 90 letters. This accounts for the period of 
90, when stated in terms of letters. 

d. The two occurrences of the other repetition, ARQN, are at an interval of 39 letters; but 
in terms of the number of intervening groupings, the interval is 12, which is obviously two 
times the length of the keying cycle. In other words, the key has in this case passed through 2 
cycles. 

e. In a long message enciphered according to such a scheme as the foregoing there would 
be many repetitions of both types discussed above (the completely periodic and the partially 
periodic) so that the cryptanalyst might encounter some difficulty in his attempts to reach a 
solution, especially if he had no information as to the basic system. It is to be noted in this 
connection that if any one of the groupings exceeds say 5, 6, or 7 letters in length, the scheme 
may give itself away rather easily, since it is clear that within each grouping the encipherment is 
strictly monoaiphabetic. Therefore, in the event of groupings of more than 5 or 6 letters, the 
monoalphabetic equivalents of tell-tale words such as ATTACK, BATTALION, DIVISION, 
etc., would stand out. The system is most efficacious, therefore, with short groupings. 

/. It should also be noted that there is nothing about the scheme which requires a regularity 
in the grouping cycle such as that embodied in the example. A lengthy grouping cycle such as 
the one shown below may just as easily be employed, it being guided by a key of its own; for 
example, the number of dots and dashes contained in the International Morse signals for the 
letters composing the phrase DECLARATION OF INDEPENDENCE might be used. Thus, A (. _) 
has 2, B (_...) has 4, and so on. Hence: 

DECLARATI0N0FINDEPENDENCE 

314433212323432314l?31241 
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The grouping cycle is 3+1 +4+4+2 . . or 60 letters in length. Suppose the same phrase 
is used as an enciphering key for determining the selection of cipher alphabets. Since the 
phrase contains 25 letters, the complete period of the system would be the least common multiple 
of 25 and 60 or 300 letters. This system might appear to yield a very high degree of crypto- 
graphic security. But the student will see as he progresses that the security is not so high as 
he may at first glance suppose it to be. 

4. Primary and secondary periods ; resultant periods. — a. It has been noted that the length 
of the complete period in a system such as the foregoing is the least common multiple of the 
length of the two component or interacting periods. In a way, therefore, since the component 
periods constitute the basic element of the scheme, they may be designated as the basic or primary 
periods. These are also hidden or latent periods. The apparent or patent period, that is, the 
complete period, may be designated as the secondary or resultant period. In certain types of 
cipher machines there may be more than two primary periods which interact to produce a 
resultant period; also, there are cases in which the latter may interact with another primary 
period to produce a tertiary period; and so on. The final, or resultant, or apparent period is the 
one which is usually ascertained first as a result of the study of the intervals between repetitions. 
This may or may not be broken down into its component primary periods. 

b. Although a solution may often be obtained without breaking down a resultant period 
into its component primary periods, the reading of many messages pertaining to a widespread 
system of secret communication is much facilitated when the analysis is pushed to its lowest 
level, that is, to the point where the final cryptographic scheme has been reduced to its simplest 
terms. This may involve the discovery of a multiplicity of simple elements which interact in 
successive cryptographic strata. 
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Section II 

SOLUTION OF SYSTEMS USING CONSTANT -LENGTH KEYING UNITS TO ENCIPHER 
VARIABLE-LENGTH PLAIN-TEXT GROUPINGS, I 

Paragraph 



Introductory remarks 5 

Aperiodic encipherment produced by groupings according to word lengths - 6 

Solution when direct standard cipher alphabets are employed 7 

Solution when reversed standard cipher alphabets are employed 8 

Comments on foregoing cases 9 



5. Introductory remarks. — a. The system described in paragraph 3 above is obviously not 
to be classified as aperiodic in nature, despite the injection of a variable factor which in that 
case was based upon irregularity in the length of one of the two elements involved in polyalpha- 
betic substitution. The variable factor was there subject to a law which in itself was periodic 
in character. 

b. To make such a system truly aperiodic in character, by elaborating upon the basic 
scheme for producing variable-length plain-text groupings, would be possible, but impractical. 
For example, using the same method as is given in paragraph 3/ for determining the lengths of 
the groupings, one might employ the text of a book; and if the latter is longer than the message 
to be enciphered, the cryptogram would certainly show no periodicity as regards the intervals 
between repetitions, which would be plentiful. However, as already indicated, such a scheme 
would not be very practical for regular communication between a large number of correspondents, 
for reasons which are no doubt apparent. The book would have to be safeguarded as would a 
code; enciphering and deciphering would be quite slow, cumbersome, and subject to error; 
and, unless the same key text were used for all messages, methods or indicators would have to 
be adopted to show exactly where encipherment begins in each message. A simpler method 
for producing constantly changing, aperiodic plain-text groupings therefore, is to be sought. 

6. Aperiodic encipherment produced by groupings according to word lengths. — a. The 
simplest method for producing aperiodic plain-text groupings is one which has doubtless long 
ago presented itself to the student, viz., encipherment according to the actual word lengths of 
the message to be enciphered. 

b. Although the average number of letters composing the words of any alphabetical language 
is fairly constant, successive words comprising plain text vary a great deal in this respect, and 
this variation is subject to no law. 1 In telegraphic English, for example, the mean length of 
words is 5.2 letters; the words may contain from 1 to 15 or more letters, but the successive 
words vary in length in an extremely irregular manner, no matter how long the text may be. 

c. As a consequence, the use of word lengths for deter minin g the number of letters to be 
enciphered by each key letter of a repetitive key commends itself to the inexperienced cryptog- 
rapher as soon as he comes to understand the way in which repeating-key ciphers are solved. 
If there is no periodicity in the cryptograms, how can the letters of the cipher text, written in 

1 It is true, of course, that the differences between two writers in respect to the lengths and characters of 
the words contained in their personal vocabularies arc often marked and can be measured. These differences 
may be subject to, certain laws, but the latter are not of the type in which we are interested, being psychological 
rather than mathematical in character. See Rickert, E., New Methods for the Study of Literature, University of 
Chicago Press, Chicago, 1927. 
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5-letter groups, be distributed into their respective monoalphabets? And if this very first step 
is impossible, how can the cryptograms be solved? 

7. Solution when direct standard cipher alphabets are employed. — a. Despite the foregoing 
rhetorical questions, the solution of this case is really quite simple. It merely involves a modifi- 
cation of the method given in a previous text, 2 wherein solution of a monoalphabetic cipher 
employing a direct standard alphabet is accomplished by completing the plain-component 
sequence. There, all the words of the entire message come out on a single generatrix of the 
completion diagram. In the present case, since the individual, separate words of a message 
are enciphered by different key letters, these words will reappear on different generatrices of the 
diagram. All the cryptanalyst has to do is to pick them out. He can do this once he has found 
a good starting point, by using a little imagination and following clues afforded by the context. 

b. An example will make the method clear. The following message (note its brevity) has 
been intercepted: 

TRECS YGETI LUVWV I K M Q I RXSPJ 

SVAGR XUXPW VMTUC SYXGX VHFFB LLBHG 



c. Submitting the message to routine study, the first step is 
and try out the possibility of direct standard alphabets having 
diagram for the first 10 letters of the message is shown in figure 2 

d. Despite the fact that the text does not all reappear on the 
same generatrix, the solution is a very simple matter because the 
first three words of the message are easily found: CAN YOU GET . 
The key letters may be sought in the usual manner and are found 
to be REA . One may proceed to set up the remaining letters of 
the message on sliding normal alphabets, or one may assume 
various keywords such as READ, REAL, REAM, etc., and try to 
continue the decipherment in that way. The former method is 
easier. The completed solution is as follows: 



to use normal alphabet strips 
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e. Note the key in the foregoing case: It is composed of the 
successive key letters of the phrase READERS DIGEST . 

/. The only difficult part of such a solution is that of making 
the first step and getting a start on a word. If the words are 
short it is rather easy to overlook good possibilities and thus 
spend some time in fruitless searching. However, solution must 
come; if not hing good appears at the beginning of the message, 
search should be made in the interior of the cryptogram or at 
the end. 



1 Military Cryptanalysis, Part I, Par. 20. 
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8. Solution when reversed standard cipher alphabets are employed. — It should by this time 
hardly be necessary to indicate that the only change in the procedure set forth in paragraph 
7c, d in the case of reversed standard cipher alphabets is that the letters of the cryptogram must 
be converted into their plain-component (direct standard) equivalents before the completion 
sequence is applied to the message. 

9. Comments on foregoing cases. — a. The foregoing cases are so simple in nature that the 
detailed treatment accorded them would seem hardly to be warranted at this stage of study. 
However, they are necessary and valuable as an introduction to the more complicated cases to 
follow. 

6. Throughout this text, whenever encipherment processes are under discussion, the pair 
of enciphering equations commonly referred to as characterizing the so-called Vigenfere method 
will be understood, unless otherwise indicated. This method involves the pair of enciphering 
equations 0i/i=0k/a; 0 p /i= 0 c / 2 , that is, the index letter, which is usually the initial letter of the 
plain component, is set opposite the key letter on the cipher component; the plain-text letter 
to be enciphered is sought on the plain component and its equivalent is the letter opposite it 
on the cipher component.* 

c. The solution of messages prepared according to the two preceding methods is particularly 
easy, for the reason that standard cipher alphabets are employed and these, of course, are derived 
from known components. The significance of this statement should by this time be quite 
obvious to the student. But what if mixed alphabets are employed, so that one or both of the 
components upon which the cipher alphabets are based are unknown sequences? The simple 
procedure of completing the plain component obviously cannot be used. Since the messages 
are polyalphabetic in character, and since the process of factoring cannot be applied, it would 
seem that the solution of messages enciphered in different alphabets and according to word 
lengths would be a rather difficult matter. However, it will soon be made clear that the solution 
is not nearly so difficult as first impression might lead the student to imagine. 



* See in this connection, Military Cryptanalysis, Part lit Section II, and Appendix 1. 
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SOLUTION OF SYSTEMS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER 
VARIABLE-LENGTH PLAIN TEXT GROUPINGS, II 

Paragraph 



Solution when the original word lengths are retained in the cryptogram _ 10 

Solution when other types of alphabets are employed 11 

Isomorphism and its importance in cry ptanaly tics 12 

Illustration of the application of phenomena of isomorphism in solving a cryptogram— 13 



10. Solution when the original word lengths are retained in the cryptogram. — a. This case 
will be discussed not because it is encountered in practical military cryptography but because it 
affords a good introduction to the case in which the original word lengths are no longer in evi- 
dence in the cryptogram, the latter appearing in the usual 5-letter groups. 

b. Reference is made at this point to the phenomenon called idiomorphism, and its value in 
connection with the application of the principles of solution by the “probable-word” method, 
as explained in a previous text. 1 When the original word lengths of a message are retained in 
the cryptogram, there is no difficulty in searching for and locating idiomorphs and then making 
comparisons between these idiomorphic sequences in the message and special word patterns 
set forth in lists maintained for the purpose. For example, in the following message note the 
underlined groups and study the letters within these groups: 

i : 

Message 

XIXLP EQVIB VEFHAPFVT RT XWK PWEWIWRD X M 
NTJCTYZL OAS XYQ ARVVRKFONT B H SFJDUUXFP 
OUVIGJPF ULBFZ RV DKUKW R 0 H R 0 Z 

Idiomokphic Sequences 

(1) PWEWIWRD (2) A R V, ( V R KFONT (3) S F J D U_U X F P 
(4) RiO H R_0 Z 



c. Reference to lists of words commonly found in military text and arranged according to 
their idiomorphic patterns or formulae soon gives suggestions for these cipher groups. Thus: 



( 1 ) 



PWEWIWRD 

DIVISION 



(3) SFJDUUXFP 

A R T I L_L E R Y 

v ' 



( 2 ) 



ARVVRKFONT 
B Ajr»«!ILA LIONS 



(4) 



R 0 H R 0 Z 
0 C L 0 C K 



1 Military Cryptanalysis, Part I, Par. 33 a-d, inclusive. 

( 8 ) 
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d. With these assumed equivalents a reconstruction skeleton or diagram of cipher alphabets 
(for ming a portion of a quadricular table) is established, on the hypothesis that the cipher 
alphabets have been derived from the sliding of a mixed component against the normal se- 
quence. First it is noted that since 0 I) =R C both in the word DIVISION and in the word OCLOCK 
their cipher equivalents must be in the same alphabet. The reconstruction skeleton is then as 
follows: 



Division, 
o’clock (1) 



Battalion (2) 



Artillery (3) 



e. Noting that the interval between 0 and R in the first and second alphabets is the same, 
direct symmetry of position is assumed. In a few moments the first alphabet in the skeleton 
becomes as follows: 



A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 
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H 




D 
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A 














F 






K 




N 
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T 
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S 
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U 












F 




J 










P 





Fjgcbe 3a. 





A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


(1) 




N 


0 


P 




S 


T 


V 


W 


X 


Z 


H 




D 


R 


A 


U 




I 






E 


F 




J 


K 


(2) 


R 


A 














F 






K 




N 


0 








T 


V 














(3) 


S 








X 
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U 












F 




J 










P 





Figure 36. 

/. The key word upon which the mixed component is based is now not difficult to find: 
HYDRAULIC . 

g. (1) To decipher the entire message, the simplest procedure is to convert the cipher 
letters into their plain-component equivalents (setting the HYDRAULIC . . . Z sequence against 
the normal alphabet at any point of coincidence) and then completing the plain-component 
sequence, as usual. The words of the message will then reappear on different generatrices. The 





key letters may then be ascertained and the solution completed. Thus, for the first three words, 
the diagram is as follows: 



Plain 

Cipher. 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

HYDRAULICBEFGJKMNOPQSTVWXZ 



XIXLP EQVIB 



Y H Y G S 
Z I Z H T 
A J A I U 
B K B J V 
C L C K W 
D M D L X 
ENEMY 
A P =S 0 



KTKHJ 
L U X I K 

M V Y J L 

N W Z K M 

0 X A L N 

P Y B M 0 

Q Z C N P 

R A D 0 Q 

S B E P R 

TCFQS 
DDGRT 
VEHSU 
W F I T V 

X G J U ff 

Y H K V X 

Z I L ff Y 

A J M X Z 

B K N Y A 

C L 0 Z B 

D M P A C 

E N Q B D 

FORCE 
A P =U„ 

Figure 4. 



VEFHAPFVT 

WKLAESLWV 

XLMBFTMXW 

YMNCGUNYX 

ZNODHVOZY 

AOPEIffPAZ 

BPQFJXQBA 

CQRGKYRCB 

DRSHLZSDC 

ESTIMATED 

A p =P 0 



(2) The 


key for the message is 


found to be SUPREME COURT 


and the complete 


message is 


as follows: 


















* 






Solution 










S 


U 


P 


R E 


M 


E 


C 


0 


U 


ENEMY 


FORCE ESTIMATED 


AS ONE 


DIVISION 


OF 


INFANTRY 


AND 


TWO 


XIXLP 


EQVIB VEFHAPFVT 


RT XWK 


PWEWIWRD 


XM 


NTJCTYZL 


OAS 


XYQ 


R 


T 


S 


U 


P 


R 


E 


M 




BATTALIONS OF 


ARTILLERY MARCHING NORTH 


AT 


SEVEN OCLOCK 




ARWRKFONT BH 


SFJDUUXFP OUVIGJPF ULBFZ 


RV 


DKUKff ROHROZ 





h. In case the plain component is the reversed normal sequence, the procedure is no different 
from the foregoing, except that in the completion diagram the reversed sequence is employed 
after the cipher letters have been converted into their plain-component equivalents. 

i. No doubt the student realizes from his previous work that once the primary mixed 
component has been recovered the latter becomes a known sequence and that the solution of 
subsequent messages employing the same set of derived alphabets, even though the keys to 
individual messages are different, then becomes a simple matter. 
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11. Solution when other types of alphabets are employed. — a. The foregoing examples 
involve the use either of standard cipher alphabets or of mixed cipher alphabets produced by 
the sliding of a mixed component against the normal sequence. There is, however, nothing 
about the general cryptographic scheme which prevents the use of other types of derived, 
interrelated, or secondary mixed alphabets. Cipher alphabets produced by the sliding of a 
mixed component against itself (either direct or reversed) or by the sliding of two different 
mixed components are very commonly encountered in these cases. 

b. The solution of such cases involves only slight modifications in procedure, namely, those 
connected with the reconstruction of the primary components. The student should be in a 
position to employ to good advantage and without difficulty what he has learned about the 
principles of indirect symmetry of position in the solution of cases of the kind described. 

c. The solution of a message prepared with mixed alphabets derived as indicated in sub- 
paragraph b, may be a diffi cult matter, depending upon the length of the message in question. 
It might, of course, be almost impossible if the message is short and there is no background for 
the application of the probable-word method. But if the message is quite long, or, what is 
more probable with respect to military communications, should the system be used for regular 
traffic, so that there are available for study several messages enciphered by the same set of 
alphabets, then the problem becomes much easier. In addition to the usual steps in solution 
by the probable-word method, guided by a search for and identification of idiomorphs, there is 
the help that can be obtained from the use of the phenomena of isomorphism,, a study of which 
forms the subject of discussion in the next paragraph. 

12. Isomorphism and its importance in cryptanalytics. — a. The term idiomorphism is 
familiar to the student. It designates the phenomena arising from the presence and positions 
of repeated letters in plain-text words, as a result of which such words may be classified according 
to their compositions, “patterns,” or formulae. The term isomorphism (from the Greek “isos” 
meaning “equal” and “morphe” meaning “form”) designates the phenomena arising from the 
existence of two or more idiomorphs with identical formulae. Two or more sequences which 
possess identical formulae axe said to be isomorphic. 

b. Isomorphism may exist in plain text or in cipher text. For example, the three words 
WARRANT, LETTERS, and MISSION are isomorphic. If enciphered monoalphabetically, then- 
cipher equivalents would also be isomorphic. In general, isomorphism is a phenomenon of 
monoalphabeticity (either plain or cipher) ; but there are instances wherein it is latent and can 
be made patent in polyalphabetic cryptograms. 

c. In practical cryptanalysis the phenomena of isomorphism afford a constantly astonishing 
source of clues and aids in solution. The alert cryptanalyst is always on the lookout for situations 
in which he can take advantage of these phenomena, for they are among the most interesting 
and most important in cryptanalytics. 

13. Illustration of the use of isomorphism. — a. Let us consider the case discussed under 
paragraph 10, wherein a message was enciphered with a set of mixed cipher alphabets derived 
from sliding the key word-mixed primary component HYDRAULIC . . . XZ against the normal 
sequence. Suppose the message to be as follows (for simplicity, original word lengths are 
retained): 

Cryptogram 

VCLLKIDVSJDCI ORKD CFSTV IXHMPPFXU E V Z Z 
F K N A K F 0 R A DKOMP ISE CSPPHQKCLZKSQ L P R 0 
J Z W B C X H0QCFFA0X R 0 Y X A N 0 EMDMZMTS 



TZFVUEAORSL AU PADDERXPNBXAR IGHFX JXI 



b. (1) Only a few minutes inspection discloses the following three sets of isomorphs: 



( 1 ) 



(a) 

(b) 

(c) 



VCLLKIDVSJDCI 

CSPPHQKCLZKSQ 

PADDERXPNBXAR 




( 2 ) 

(3) 



(a) IXHMPPFXU 

(b) HOQCFFAOX 

' 

(a) N A K F 0 R A 

(b) ROYXANO 

x ' 



(2) Without stopping to refer to word-pattern lists in an attempt to identify the very 
striking idiomorphs of the first set, let the student proceed to build up partial sequences of 
equivalents, as though he were dealing with a case of indirect symmetry of position. Thus: 2 
From isomorphs (1) (a) and (1) (b): 



VOC; COS; LOP; KoH; IoQ; DoK; SOL; JoZ; 
from which the following partial sequences are constructed: 

(a) VCSLP (b) DKH (c) IQ (d) JZ 
From isomorphs (1) (b) and (1) (c): 



COP; SOA; POD; HoE; QoR; KoX; LON; ZOB; 
from which the following partial sequences are constructed: 

(e) CPD (f) SA (g) HE (h) QR (i) KX (j) LN (k) ZB 
From isomorphs (1) (a) and (1) (c): 



VoP; COA; LoD; KoE; IoR; DoX; SON; JOB; 

from which the following partial sequences are constructed: 

(1) LDX (m) VP (n) CA (o) KE (p) IR (q) SN (r) JB 

Noting that the data from the three isomorphs of this set may be combined (VCSLP and CPD 
make VCSLP . . D; the latter and LDX make VCSLP . . D . . . X), the following sequences are 
established: 

f 1 2 3 4 5 6 7 8 9 10 11 12 13 

(!) V CSLPANDKH . XE 




c. (1) The fact that the longest of these chains consists of exactly 13 letters and that no 
additions can be made from the other two cases of isomorphism, leads to the assumption that a 
“half-chain” is here disclosed and that the latter represents a decimation of the original primary 

123456789 

component at an even interval. Noting the placement of the letters V . S . P . N . K , 



! The symbol O is to be read “is equivalent to.” 
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which gives the sequence the appearance of being the latter half of a keyword-mixed sequence 
running in the reversed direction, let the half-chain be reversed and extended to 26 places, as 
follows: 

X 2 3 4 5 6 7 g 9 10 11 12 13 14 15 18 17 18 19 20 21 22 23 24 25 28 

E . KNPSVXHDALC 

(2) The data from the two partial chains (JZ. .B and IQ. .R) may now be used, and the 
letters inserted into their proper positions. Thus: 

1 2 3 4 S 6 7 8 9 10 11 12 13 14 1« 16 17 18 19 20 21 22 23 24 26 28 

E. .JK.N.PQS.V.XZH.DRA.LICB 

(3) The sequence H . D R A . L I C soon suggests HYDRAULIC as the key word. When 

the mixed sequence is then developed in full, complete corroboration will be found from the data 

of isomorphs 2 (a) (b) and 3 (a) (b). Thus: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 IS 18 17 18 19 20 21 22 23 24 2S 28 

HYDRAULICBEFGJKMNOPQSTVWXZ 

(4) From idiomorphs (2) (a) and (2) (b), the interval between H and I is 7; it is the same 
for 0 and X, Q and H , C and M, etc. From idiomorphs (3) (a) and (3) (b) the interval between 
R and N is 13 ; it is the same for 0 and A , Y and K , etc. 

d. The message may now be solved quite readily, by the usual process of converting the 
cipher-text letters into their plain-component equivalents and then completing the plain com- 
ponent sequences. The solution is as follows: 

[Key: STRIKE WHILE THE IRON IS . . . (HOT?)] 
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e. (1) In the foregoing illustration the steps are particularly simple because of the following 
circumstances: . • 



(a) The actual word lengths are shown. , , 

(b) The words are enciphered monoalphabetically by different alphabets belonging to a 
set of secondary alphabets. 

(c) Repetitions of plain-text words, enciphered by different alphabets, produce isomorphs 
and the lengths of the isomorphs are definitely known as a result of circumstance (a). 

(2) Of these facts, the last is of most interest in the present connection. But what if the 
actual word lengths are no;/' shown; that is, what if the text to be solved is intercepted in the 
usual 6-letter-group form? 
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Section IV 

SOLUTION OF SYSTEMS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER 
VARIABLE-LENGTH PLAIN-TEXT GROUPINGS, m 

Paragraph 



General remarks 14 

Word separators 15 

Variations and concluding remarks on foregoing systems 16 



14. General remarks. — a. The cases described thus far are particularly easy to solve because 
the cryptanalyst has before him the messages in their true or original word lengths. But in 
military cryptography this is seldom or never the case. The problem is therefore made some- 
what more difficult by reason of the fact that there is nothing to indicate definitely the limits of 
enoiphennent by successive keyletters. However, the solution merely necessitates more ex- 
perimentation in this case than in the preceding. The cryptanalyst must take careful note of 
repetitions which may serve to “block out” or delimit words, and hope that when this is done he 
will be able to find and identify certain sequences having fa m iliar idiomorphic features or pat- 
terns, such as those noted above. If there is plenty of text, repetitions will be sufficient in number 
to permit of employing this entering wedge. 

b. Of course, if any sort of stereotypic phraseology is employed, especially at the beginnings 
or endings of the messages, the matter of assuming values for sequences of cipher letters is easy, 
and affords a quick solution. For example, suppose that as a result of previous work it has been 
fouhd that many messages begin with the expression REFERRING TO YOUR NUMBER .... 
Having Beveral messages for study, the selection of one which begins with such a common 
idiomorphism as that given by the word REFERRING is a relatively simple matter; and having 
found the word REFERRING, if with a fair degree of certainty one can add the words TO YOUR 
NUMBER, the solution is probably well under way. 

c. (I) Take the case discussed in paragraph 13, but assume that word lengths are no longer 
indicated because the message is transmitted in the usual 5-letter groups. The process of 
ascertaining the exact length of sequences which are isomorphic, or, as the process is briefly 
termed, “blocking out isOmdrphs” becomes a more difficult matter and must often rest' upon 
rather tenuous threads of reasoning. For example, take the illustrative message just dealt 
with and let it be assumed that it was arranged in 5-letter groups. 

VCLLK IDVSJ DCIOR KDCFS TVIXH MPPFX 

UEVZZ FKNAK FORAD KOMPI SECSP PHQKC 

LZKSQ LPROJ ZWBCX HOQCF FAOXR OYXAN 

OEMDM ZMTST ZFVUE AORSL AUPAD DERXP 

ft B X A R IGHFX JXI 

■ ; (2) The detection of isomorphisms now becomes a more difficult matter. There is no 
special trouble in picking out the following three isomorphic sequences: 

(1) V C L L K I D V S J D C I 

(2) CSPPHQKCLZKSQ 

(3) P A D D E R X P N B X A R 

(14) 
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since the first one happens to be at the beginning of the message and its left-hand boundary, or 
“head,” is marked by (or rather, coincides with) the beginning of the message. By a fortunate 
circumstance, the right-hand boundary, or “tail,” can be fixed just as accurately. That the 
repetition extends as far as indicated above is certain for we have a cheok on the last column 
I, Q, R. If an additional column were added, the letters would be 0, L, I . Since the Second 
letter has previously appeared while the first and third have not, a contradiction results and the 
new column may not be included. 

If, however, none of the three letters 0, L, I had previously appeared, so that there could 
be no means of getting a check on their correctness, it would not be possible to block out or 
ascertain the extent of the isomorphism in such a case. All that could be said would be that 
it seems to include the first 13 letters, bui it might continue jurther. 

d. (1) However, the difficulty or even the impossibility of blocking out the isomorphs to 
their full extent is not usually a serious matter. After all, the cryptanalyst uses the phenomenon 
not to identify words but to obtain cryptanalytic data for reconstructing cipher alphabets. 
For example, how many data are lost when the illustrative message of subparagraph 13a is 
rewritten in 5-letter groups as in subparagraph 14c (1)? Suppose the latter form of massage 
be studied for isomorphs: 

VCLLK IDVSJ DC I OR KDCFS TVI XH MPPFX UEVZZ 

FKNAK FORAD KOMPI SE CSP PHQKC LZKSQ LPROJ 

ZWBCX HOQCF FAO XR OYXAN OEMDM ZMTST ZFVUE 

AORSL A UPAD DERXP NBXA R IGHFX JXI 

(2) If the underscored sequences are compared with those in the message in subparagraph 
13a, it will be found that only a relatively small amount of information has been lost. Certainly 
not enough to cause any difficulty have been lost in this case, for all the data necessary for the 
reconstruction of the mixed cipher component came from the first set of isomorphs, and the 
latter are identical in length in both cases. Only the head and tail letters of the second pair 
of isomorphic sequences are not included in the underscored sequences in the 5-letter version' 
of the message. The third pair of isomorphic sequences shown in paragraph 136 does not appear 
in the 5-letter version since there is only one repeated letter in this case. In long messages of 
when there are many short messages, a study of isomorphism will disclose a sufficient number of 
partial isomorphs to give data usually sufficient for purposes of alphabet reconstruction. 

e. It should be noted that there is nothing about the phenomenon of isomorphism which 
restricts its use to cases in which the cipher alphabets are secondary alphabets resulting from 
the sliding of a mixed component against the normal. It can be useful in all cases of interrelated 
secondary alphabets no matter what the basis of their derivation may be. 

/. In subsequent studies the important role which the phenomenon of isomorphism plays 
in cryptanalytics will become more apparent. When the traffic is stereotypic in character, 
even to a slight degree, so that isomorphism may extend over several words or phrases, the 
phenomenon becomes of highest importance to the cryptanalyst and an extremely valuable tool 
in his hands. 

15. Word separators. — a. One of the practical difficulties in employing systems in which the 
keying process shifts according to word lengths is that in handling such a message the decrypto- 
graphing clerk is often not certain exactly when the termination of a word has been reached, 
and thus time is lost by him. For instance, while decryptographing a word such as INFORM 
the clerk would not know whether he now has the complete word and should shift to the next 
key letter or not: The word might be INFORMS, INFORMED, INFORMING, INFORMAL, INFOR- 



MATION, etc. The past tense of verbs, the plural of norms, and terminations of various sorts 
capable of being added to word roots would give rise to difficulties, and the latter would be 
especially troublesome if the messages contained a few telegraphic errors. Consequently, a 
scheme which is often adopted to circumvent this source of trouble is to indicate the end of a 
word by an infrequent letter such as Q or X, and enciphering the letter. In such usage these 
letters are called word separators. 

b. When word separators are employed and this fact is once discovered, their presence is 
of as much aid to the cryptanalyst in his solution as it is to the clerks who are to decryptograph 
the messages. Sometimes the presence of these word separators, even when enciphered, aids 
or makes possible the blocking out of isomorphs. 

16 . Variations and concluding remarks on foregoing systems. — a. The systems thus far 
described are all based upon word-length encipherment using different cipher alphabets. Words 
are markedly irregular in regard to this feature of their construction, and thus aperiodicity is 
imparted to such cryptograms. But variations in the method, aimed at making the latter 
somewhat more secure, are possible. Some of these variations will now be discussed. 

b. Instead of enciphering according to natural word lengths, the irregular groupings of the 
text may be regulated by other agreements. For example, suppose that the numerical value 
(in the normal sequence) of each key letter be used to control the number of letters enciphered 
by the successive cipher alphabets. Depending then upon the composition of the key word or 
key phrase, there would be a varying number of letters enciphered in each alphabet. If the 
key word were PREPARE, for instance, then the first cipher alphabet would be used for 16 
(P=16) letters, the second cipher alphabet, for 18 (=R) letters, and so on. Monoalphabetic 
encipherment would therefore allow plenty of opportunity for tell-tale word patterns to manifest 
themselves in the cipher text. Once an entering wedge is found in this manner, solution would 
be achieved rather rapidly. Of course, all types of cipher alphabets may be employed in this 
and the somewhat similar schemes described. 

e. If the key is short, and the message is long, periodicity will be manifested in the crypto- 
gram, so that it would be possible to ascertain the length of the basic cycle (in this case the length 
of the key) despite the irregular groupings in encipherment. The determination of the length 
of the cycle might, however, present difficulties in some cases, since the basic or fundamental 
period would not be clearly evident because of the presence of repetitions which are not periodic 
in their origin. For example, suppose the word PREPARE were used as a key, each key letter 
being employed to encipher a number of letters corresponding to its numerical value in the 
normal sequence. It is clear that the length of the basic period, in terms of letters, would here 
be the sunr of the numerical values of P (=16)+R (=18) + E (=5), and so on, totalling 79 
letters. But because the key itself contains repeated letters and because encipherment by each 
key letter is monoalphabetic there would be plenty of cases in which the first letter P would 
encipher the same or part of the same word as the second letter P, producing repetitions in the 
cryptogram. The same would be true as regards encipherments by the two R's and the two 
£'fl in this key word. Consequently, the basic period of 79 would be distorted or masked by 
Aperiodic repetitions, the intervals between which would not be a function of, nor bear any 
relation to, the length of the key. The student will encounter more cases of this kind, in which 
a fundamental periodicity is masked or obscured by the presence of cipher-text repetitions not 
attributable to the -fundamental cycle. The experienced cryptanalyst is on the lookout for 
phenomena of this type, when he finds in a polyalphabetic cipher plenty of repetitions but with 
no factorable constancy which leads to the disclosure of a short period. He may conclude, then, 
either that the cryptogram involves several primary periods which interact to produce a long 
resultant period, or that it involves a fairly long fundamental cycle within which repetitions of a 
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nonperiodic origin are present and obscure the phenomena manifested by repetitions of a periodic 
origin. ■ - 

d. (1) A logical extension of the principle of polyalphabetic encipherment of variable-length 
plain-text groupings is the case in which these plain-text groupings rarely exceed 4 letters, so 
that a given cipher alphabet is in play for only a very short time, thus breaking up what might 
otherwise appear as fairly long repetitions in the cipher text. For example, suppose the letters 
of the alphabet, arranged in their normal-frequency order, were set off into four groups, as 
follows: .;■:■■■ ,[■■■. , , 

ETRIN OASDLC HFUPMYG WVBXKQJZ 

Group 1 Group 2 Group 3 Group 4 

(2) Suppose that a letter in group 1 means that one letter will be enciphered; a letter in 
group 2, that two letters will be enciphered; and so on. Suppose, next, that a rather lengthy 
phrase were used as a key, for example, PREPARED UNDER THE DIRECTION OF THE CHIEF 
SIGNAL OFFICER FOR USE WITH ARMY EXTENSION COURSES. Suppose, finally, that each 
letter of the key were used not only to select the particular cipher alphabet to be used, but also 
to control the number of letters to be enciphered by the selected alphabet, according to the 

scheme outlined above. Such an enciphering scheme, using the - HYDRAULIC XZ primary 

cipher component sliding against the normal plain component, would yield the following 
groupings: 



Grouping.. 3 11 3 2112 31 211 1 3 12 

Key PREP ARED UNDERTHED 

Plain. FIR S T DIV IS I 0 NW ILL A DV A N C EAT F IV 

Cipher WHB T R THJ GV F X MX JNN N UW E N W AHQ M EW ‘ * 



Grouping 111211212 3 1 3 12 3 1 

Key..... IRECTIONO FTHEC HI... 

Plain. E F I FT E E NA M AS SEC 0 NDD I VI SIO N 

Cipher F C P JY Z F AO D OB RMJ B JR R P RN PCK S . . . 



(3) Here it will be seen that any tendency for the formation of lengthy repetitions would 
be counteracted by the short groupings and quick shifting of alphabets. The first time the 
word DIVISION occurs it is enciphered as THJGVFXM; the second time it occurs it is enciphered 
as RPRNPCKS . Before DIVISION can be twice enciphered by exactly the same sequence of key 
letters, an interval of at least 140 letters must intervene between the two occurrences of the 
word (the sum of the values of the letters of the key phrase =140); and then the chances that 
the key letter P would begin the encipherment of DIV are but one in three. Only one of these 
three possible encipherments will yield exactly the same sequence of cipher equivalents the 
second time as was obtained the first time. For example, if the text were such as to place two 
occurrences of the word DIVISION in the positions shown below, their encipherments would 
be as follows: 



3 11 3 2112 3 1 

PREP AREDUN 
FIR S T DIV IS I 0 N . . . . 
THJ GV F X M . . . . 



3113 2112 31 

PREP ARED UN 

DI VI S I ON ... . 

TH ZG T P NM . . . . 
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Although the word DIVISION, on its second appearance, begins but one letter beyond the place 
where it begins on its first appearance, the cipher equivalents now agree only in the first two 
letters, the fourth, and the last letters. Thus: 

DIVISION 

(1) THJGVFXM 

(2) THZGTPNM 

e. Attention is directed to the characteristics of the foregoing two encipherments of the 
same word. When they are superimposed, the first two cipher equivalents are the same in the 
two encipherments; then there is a single interval where the cipher equivalents are different; 
the next cipher equivalent is the same; then follow three intervals with dissimilar cipher equiva- 
lents; finally, the last cipher equivalent is the same in both cases. The repetitions here extend 
only to one or two letters; longer repetitions can occur only exceptionally. The two encipher- 
ments yield only occasional coincidences, that is, places where the cipher letters are identical; 
moreover, the distribution of the coincidences is quite irregular and of an intermittent character. 

/. This phenomenon of intermittent coincidences, involving coincidences of single letters, 
pairs of letters, or short sequences (rarely ever exceeding pentagraphs) is one of the character- 
istics of this general class of polyalphabetic substitution, wherein the cryptograms co mm only 
manifest what appears to be a disturbed or distorted periodicity. 

g. From a technical standpoint, the cryptographic principle upon which the foregoing 
system is based has much merit, but for practical usage it is entirely too slow and too subject 
to error. However, if the encipherment were mechanized by machinery, and if the enciphering 
key ware quite lengthy, such a system and mechanism becomes of practical importance. Cipher 
machines for accomplishing this type of substitution will be treated in a subsequent text. 
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17. Variable-length groupings of the keying sequence. — The preceding cases deal with 
simple methods of eliminating or avoiding periodicity by enciphering variable-length groupings 
of the plain text, using constant-length keying units. In paragraph 2a, however, it was pointed 
out that periodicity can also be suppressed by applying variable-length key groupings to con- 
stant-length plain-text groups. One such method consists in irregularly interrupting the keying 
sequence, if the latter is of a limited or fixed length, and recommencing it (from its initial point) 
after such interruption, so that the keying sequence becomes equivalent to a series of keys of 
different lengths. Thus, the key phrase BUSINESS MACHINES may be expanded to a series of 
irregular-length keying sequences, such as BUSI/BUSINE/BU/BUSINESSM/BUSINESSMAC, etc. 
Various schemes or prearrangements for indicating or determining the interruptions may be 
adopted. Three methods will be mentioned in the next paragraph. 

18. Methods of interrupting a cyclic keying sequence. — a. There are many methods of 
interrupting a keying sequence which is basically cyclic, and which therefore would give rise 
to periodicity if not interfered with in some way. These methods may, however, be classified 
into three categories as regards what happens after the interruption occurs: 

(1) The keying sequence merely stops and begins again at the initial point of the cycle. 

(2) One or more of the elements in the keying sequence may be omitted from time to time 
irregularly. 

(3) The keying sequence irregularly alternates in its direction of progression, with or 
without omission of some of its elements. 

b. These methods may, for clarity, be represented graphically as follows. Suppose the 
key consists of a cyclic sequence of 10 elements represented symbolically by the series of numbers 
1, 2, 3, . . ., 10. Using an asterisk to indicate an interruption, the following may then represent 
the relation between the letter number of the message and the element number of the keying 
sequences in the three types mentioned above: 

( Letter No 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

Key element No. l-2-3-4-*-l-2-3-4-5- 6-*- 1- 2- 3-*- 1- 2- 3- 4- 5-6- 7-* 

Letter No... 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 

Key element No 1- 2- 3- 4- 5- 6- 7- 8- 9-10-*- 1- 2- 3-*- 1- 2- etc. 

Letter No 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

|Key element No 1-2-3- *-7-8-9-10-1-2-*- 4- 5- 6-*- 3- 4- 5- 6- 7- 8- 9-10- 

1 } ' Letter No 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 

Key element No.. 1-*- 8- 9-10- 1- 2-*- 5- 6- 7-*- 9-10- 1-*- 5-6-7- etc. 

(19) 
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m 



(Letter No 

Key element No. 

Letter No. .. 

[Key element No. 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

l-2-3-4-5-*-4-3-*-4-5- 6- 7- 8- 9-10- l-*-10- 9- 8- 7-*- 8 
21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 

9-10- 1- 2- 3-*-2- 1-10- 9- 8-*- 9-10- 1- 2- 3 etc. 



As regards the third method, which involves only an alternation in the direction of progression 
of the keying sequence, if there were no interruptions in the key it would mean merely that a 
10-element keying sequence, for example, could be treated as though it were an 18-element 
sequence and the matter could then be handled as though it were a special form of the second 
method. But if the principles of the second and third method are combined in one system, 
the matter may become quite complex. 

c. If one knows when the interruptions take place in each cycle, then successive sections of 
the basic keying cycle in the three cases may be superimposed. Thus: 



Method (1) 

Keying element No__ 1234 56789 10 

Letter No 1 2 3 4 | 

Letter No 5 6 7 8 9 10 [ 

Letter No 11 12 13 | 

Letter No... 14 15 16 17 18 19 20 1 

Letter No 21 22 23 24 25 26 27 28 29 30 | 

Letter No 31 32 33 | 

Letter No 34 35 etc. 

Method (2) 

Keying element No__ 123456789 10 

Letter No 1 2 3 | — — — 4 5 6 7 

Letter No ...... 8 9 | — 10 11 12 1 

Letter No — — 13 14 15 16 17 18 19 20 

Letter No 21 J — — — — — — 22 23 24 

Letter No 25 26 J — — 27 28 29 1 — 30 31 

Letter No. 32 [ — — — 33 34 35 etc. 

Method (3) 

Keying element No.. 123456789 10 

Letter No 1 2 3 4 5 | — — — — — 

Letter No — — |7 6 — — — — — — 

"Letter No— — — — 8 9 10 11 12 13 14 

Letter No 15 | — — — — — | 19 18 17 16 

Letter No 23 24 25 | — — — — 20 21 22 

Letter No 27 26 — — — — — | 30 29 28 

Letter No. 33 34 35 etc. 31 32 



Obviously if one does not know when or how the interruptions take place, then the successive 
sections of keying elements cannot be superimposed as indicated above. 

d. The interruption of the cyclic keying sequence usually takes place according to some 
prearranged plan, and the three basic methods of interruption will be taken up in turn, using 
a short mnemonic key as an example. 
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e. Suppose the correspondents agree that the interruption in the keying sequence will take 
place after the occurrence of a specified letter called an interruptor which may be a letter of the 
plain text, or one of the cipher text, as agreed upon in advance. Then, since in either case 
there is nothing fixed about the time the interruption will occur — it will take place at no fixed 
intervals — not only does the interruption become quite irregular, following no pattern, but also 
the method never reverts to one having periodicity. Methods of this type will now be discussed 
in detail. 

19. Interruptor is a plain-text letter. — a. Suppose the correspondents agree that the inter- 
ruption in the key will take place immediately after a previously agreed-upon letter, say R, 
occurs in the plain text. The key would then be interrupted as shown in the following example 
(using the mnemonic key BUSINESS MACHINES and the HYDRAULIC . . . XZ sequence): 
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b. Instead of employing an ordinary plain-text letter as the interruptor, one might reserve 
the letter J for this purpose (and use the letter I whenever this letter appears as part of a plain- 
text word). This is a quite simple variation of the basic method. The letter J acts merely 
as though it were a plain-text letter, except that in this case it also serves as the interruptor. 
The interruptor is then inserted at random, at the whim of the enciphering clerk. Thus: 



Key BUSINESSMAC 

Plain TROOPSWILLJ 



BUSINESSM BUSINESSMACHINESBUSIN 
BEHALTEDJ A T R 0 A D I U N C T I 0 N F I V E S I X 



c. It is obvious that repetitions would be plentiful in cryptograms of this construction, 
regardless of whether a letter of high, medium, or low frequency is selected as the signal for key 
interruption. If a letter of high frequency is chosen, repetitions will occur quite often, not 
only because that letter will certainly be a part of many common words, but also because it will 
be followed by words that are frequently repeated; and since the key starts again with each 
such interruption, these frequently repeated words will be enciphered by the same sequence of 
alphabets. This is the case in the first of the two foregoing examples. It is clear, for instance, 
that every time the word ARTILLERY appears in the cryptogram the cipher equivalents of 
TILLERY must be the same. If the interruptor letter were A p instead of Rp, the repetition 



1 Also called at times an “influence" letter because it influences or modifies normal procedure. In some 
cases no influence or interruptor letter is used, the interruption or break in the keying sequence occurring after 
a previously-agreed-upon number of letters has been enciphered. 



would include the cipher equivalents of RTILLERY ; if it were T p , ILLERY, and so on. On the 
other hand, if a letter of low frequency were selected as the interruptor letter, then the encipher- 
ment would tend to approximate that of normal repeating-key substitution, and repetitions 
would be plentiful on that basis alone. 

d. Of course, the lengths of the intervals between the repetitions, in any of the foregoing 
cases, would be irregular, so that periodicity would not be manifested. The student may 
inquire, therefore, how one would proceed to solve such messages, for it is obvious that an 
attempt to allocate the letters of a single message into separate monoalphabetic distributions 
cannot be successful unless the exact locations of the interruptions are known — and they do 
not become known to the cryptanalyst until he has solved the message, or at least a part of it. 
Thus it would appear as though the would-be solver is here confronted with a more or less insoluble 
dilemma. This sort of reasoning, however, makes more of an appeal to the novice in cryptog- 
raphy than to the experienced cryptanalyst, who specializes in methods of solving cryptographic 
dilemmas. 

e. (1) The problem here will be attacked upon the usual two hypotheses, and the easier 
one will be discussed first. Suppose the system has been in use for Borne time, that an original 
solution has been reached by means to be discussed under the second hypothesis, and that the 
cipher alphabets are known. There remains unknown only the specific key to messages. Exam- 
ining whatever repetitions are found, an attack is made on the basis of searching for a probable 
word. Thus, taking the illustrative message in subparagraph a, suppose the presence of the 
word ARTILLERY is suspected. Attempts are made to locate this word, basing the search 
upon the construction of an intelligible key. Beginning with the very first letter of the message, 
the word ARTILLERY is juxtaposed against the cipher text, and the key letters ascertained, 
using the known alphabets, which we will assume in this case are based upon the HYDRAULIC 
. . . XZ sequence sliding against the normal. Thus: 

Cipher BOLYRPJDR 

Plain ARTILLERY 

“Key” BHJQPIBFU 

(2) Since this “key” is certainly not intelligible text, the assumed word is moved one letter 
to the right and the test repeated, and so on until the following place in the test is reached: 

Cipher SXDJUPSYI 

Plain ARTILLERY 

Key SIBUSINEB 

(3) The sequence BUSINE suggests BUSINESS; moreover, it is noted that the key is in- 
terrupted both times by the letter R p . Now the key may be applied to the beginning of the 
message, to see if the whole key or only a portion of it has been recovered. Thus: 

Key BUSINESSBUS 

Cipher BOLYRPJDROJ 

Plain AMMUNITIUMT 

(4) It is obvious that BUSINESS is only a part of the key. But the deciphered sequence 

certainly seems to be the word AMMUNITION. When this is tried, the key is extended to 
BUSINESS MA. . . . Enough has been shown to clarify the procedure. 
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/. The foregoing solution is predicated upon the hypothesis that the cipher alphabets are 
known. But what if this is not the case? What of the steps necessary to arrive at the first 
solution, before even the presence of an interruptor is suspected? The answer to this question 
leads to the presentation of a method of attack which is one of the most important and powerful 
means the cryptanalyst has at his command for unraveling many knotty problems. It is called 
solution by mperimposition, and warrants detailed treatment. 

20. Solution by superimposition. — a. Basic principles. — (1) In solving an ordinary 
repeating-key cipher the first step, that of ascertaining the length of the period, is of no signifi- 
cance in itself. It merely paves the way for and makes possible the second step, which consists 
in allocating the letters of the cryptogram into individual monoalphabetic distributions. The 
third step then consists in solving these distributions. Usually, the text of the message is trans- 
cribed into its periods and is written out in successive lines corresponding in length with that 
of the period. The diagram then consists of a series of columns of letters and the letters in each 
column belong to the same monoalphabet. Another way of looking at the matter is to conceive 
of the text as having thus been transcribed into superimposed periods: in such cage the letters in 
each column have undergone the same kind of treatment by the same elements (plain and cipher 
components of the cipher alphabet). 

(2) Suppose, however, that the repetitive key is very long and that the message is short, so 
that there are only a very few cycles in the text. Then the solution of the message becomes 
difficult, if not impossible, because there is not a sufficient number of superimposable periods to 
yield monoalphabetic distributions which can be solved by frequency principles. But suppose 
also that there are many short cryptograms all enciphered by the same key. Then it is clear 
that if these messages are superimposed: 

(a) The letters in the respective columns will all belong to individual alphabets; and 

(b) If there is a sufficient number of such superimposable messages (say 25-30, for English), 
then the frequency distributions applicable to the successive columns of text can be solved — 
without knowing the length of the key. In other words, any difficulties that may have arisen on 
account of failure or inability to ascertain the length of the period have been circumvented. 
The second step in normal solution is thus "by-passed.” 

(3) Furthermore, and this is a very important point, in case an extremely long key is em- 
ployed and a series of messages beginning at different initial points are enciphered by such a key, 
this method of solution by superimposition can be employed, provided the messages can be super- 
imposed correctly, that is, so that the letters which fall in one column really belong to one cipher 
alphabet. Just how this can be done will be demonstrated in subsequent paragraphs, but a 
clue has already been given in paragraph 18c. At this point, however, a simple illustration of 
the method will be given, using the substitution system discussed in paragraph 19. 

b. Example. — (1) A set of 35 messages has been intercepted on the same day. Presumably 
they are all in the same key, and the presence of repetitions between messages corroborates this 
assumption. But the intervals between repetitions within the same message do not show any 
common factor and the messages appear to be aperiodic in nature. The probable-word method 
has been applied, using standard alphabets, with no success. The messages are then super- 
imposed (Fig. 5); the frequency distributions for the first 10 columns are as shown in Figure 6. 
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1. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

2. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

3. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

4. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

5. ABCDEFGHIJKLMNOPQRSTUVWXYZ 
0 . ABCDEFGHIJKLMNOPQRSTUVWXYZ 
7. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

s. abcBefghijklmnopqrstuvwxyz 

9. ABCDEFGHi JKLMN.OPQR'STD VWXIZ 



10. ABCDEFGHIJKLMNOPQRSTUVWXYZ 



Fiounz 6. 
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(2) The 1st and 2d distributions are certainly monoalphabetic. There are very marked 
crests and troughs, and the number of blanks (14) is more than satisfactory in both cases. (Let 
the student at this point refer to Par. 14 and Chart 5 of Military Cryptanalysis, Part I.) But 
the 3d, 4th, and remaining distributions appear no longer to be monoalphabetic. Note particu- 
larly the distribution for the 6th column. Prom this fact the conclusion is drawn that some 
disturbance in periodicity has been introduced in the cryptograms. In other words, although 
they all start out with the same alphabet, some sort of interruption takes place so as to suppress 
periodicity. 

(3) However, a start on solution may be made by attacking the first two distributions, 
frequency studies being aided by considerations based upon probable words. In this case, since 
the text comprises only the beginnings of messages, assumptions for probable words are more 
easily made than when words are sought in the interiors of messages. Such common intro- 
ductory words as REQUEST, REFER, ENEMY, WHAT, WHEN, IN, SEND, etc., are good ones 
to assume. Furthermore, high-frequency digraphs used as the initial digraphs of common 
words will, of course, manifest themselves in the first two columns. The greatest aid in this 
process is, as usual, a familiarity with the “word habits” of the enemy. 

(4) Let the student try to solve the messages. In so doing he will more or less quickly find 
the cause of the rapid falling off in monoalphabeticity as the columns progress to the right from 
the initial point of the messages. 

21. Interruptor is a cipher-text letter. — a. In the preceding case a plain-text letter serves 
as the interruptor. But now suppose the correspondents agree that the interruption in the key 
will take place immediately after a previously-agreed-upon letter, say Q, occurs in the cipher 
text. The key would then be interrupted as shown in the following example: 
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Cryptogram 

B_0 L Y R PJDRO JKXTP FYXSX BPUUQ HRNMY 

TTXHP CRFQB EJFIE LLBON (JJJQVE C X B 0 D 

F P A Z 9 ONUFI CXXXX 

b. In the foregoing example, there are no significant repetitions. Such as do occur comprise 
only digraphs, one of which is purely accidental. But the absence of significant, long repetitions 
is itself purely accidental; for had the interruptor letter been a letter other than Q 0 , then the 
phrase AMMUNITION FOR, which occurs twice, might have been enciphered identically both 



